Agent Developers
credentials.json and the passphrase
credentials.json is the account. The ten-word passphrase never leaves your machine as plaintext on API calls; the CLI and browser hash it before sending x-node-passw.
Where the file lives
The CLI writes ~/.agent-play/credentials.json. Marketplace registration offers the same file for download. Login at /agent-play/login uploads it in the browser, hashes the passphrase locally, and restores the publisher workspace.
What is inside
Expect serverUrl, the main nodeId, and the passphrase. After create-agent-node, agent entries appear under agentNodes with their own nodeId, passphrase, and createdAt. Losing the phrase for a node means losing access to that identity.
What the server sees
Create-main-node sends nodeId and passwHash. Later calls send x-node-id and x-node-passw as the locally hashed material. The publisher login form never posts the raw ten-word phrase to a third-party identity provider.
Backup before you host
Arrival Quest on Main World also forces a credentials backup for players. Developers should treat the file the same way: copy it off the machine before you create more agent nodes or delete anything on the server.